CVE-2022-37720

Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting XSS. When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation when the malicious blog post is load...

Cross site scripting

Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting XSS. When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation when the malicious blog post is load...

CVE-2022-37721

PyroCMS 3.9 is vulnerable to a stored Cross-Site Scripting (XSS) attack in blog posts. A low-privileged user (e.g., author) can inject crafted HTML/JavaScript, which may execute in other users’ browsers and lead to admin account takeover or privilege escalation. The CVSS 3.1 base score is 9.0 (CR...

PT-2022-24049 · Pyrocms · Pyrocms

Name of the Vulnerable Software and Affected Versions: PyroCMS version 3.9 Description: The issue allows a low-privileged user, such as an author, to inject crafted HTML and JavaScript payload in a blog post, leading to full admin account takeover or privilege escalation. This is a stored Cross...

CVE-2022-37720

Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting XSS. When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation when the malicious blog post is load...

CVE-2022-37721

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting XSS when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation...

CVE-2021-29334

An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html...

CVE-2021-29334

An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html...

Cross site request forgery (csrf)

An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html...

CVE-2021-29334

An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html...

PT-2022-9918 · Jizhicms · Jizhicms

Name of the Vulnerable Software and Affected Versions: JIZHI CMS version 1.9.4 Description: A CSRF issue allows adding an admin account via the index or the "/admin.php/Admin/adminadd.html" API endpoint. Recommendations: For JIZHI CMS version 1.9.4, update to a newer version that contains a fix f...

CVE-2021-29334

The CVE-2021-29334 entry affects JIZHI CMS 1.9.4, which contains a CSRF vulnerability that can add an administrator account via the index path /admin.php/Admin/adminadd.html. The issue is described consistently across multiple sources (e.g., Red Hat, OSV, CVE lists) as a CSRF flaw that enables ac...

CVE-2021-29334

An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html...

Design/Logic Flaw

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpufencryption. This could allow an attacker having access to the AUTHKEY and AUTHSALT constant via...

Cross-site Scripting in librenms/librenms

A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary...

CVE-2022-4068

A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary...

CVE-2022-42246

Doufox 0.0.4 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that can be exploited to add a system administrator account. The root cause, as described in the sources, is insufficient validation of requests from trusted users in the web application. Practical impact is that an att...

Feed Them Social < 3.0.1 - Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

xss in live edit

Description when you make website and login as admin if u add user as admin he maybe evil admin n live edit https://demoxss.microweber.net/?editmode=y i start edit as html i see i can write script but didnt pass when u open site as end user then i just try add html tag with events but the sam...

Unintended API key generation

Description The API keys sections are vulnerable to CSRF. The aggressor can generate the key on the admin's account without prior knowledge of admin credentials. The successful CSRF will generate new keys on the admin's account. Proof of Concept history.pushState'', '', '/' document.forms0.submit...